CLAIMS 

What is claimed is: 



1>^^^~^ A method of reconstructing a session, th^^ethod comprising: 



receiving a pluraUty of packets ojfe^'a^etwork interface; 

3 analyzing the plurality o|;^J^kets to identify at least a first flow; 

4 identifying an appji^tion for the at least a first flow; 

5 selecting a cp^esponding application flow identifier for the application; 

6 using the corresponding application flow identifier to identify a plurality of flows in 

7 >tne plurality of packets corresponding to the session. 

1 2. The method of claim 1 fiirther comprising generating a quality of service report for the 

2 session based on the application. 



1 - : 



1 3. The method of claim 1 wherein the session is associated with an end user experience 

2 occurring within a definite time boimd. 

1 4. The method of claim 3 wherein the session is comprised of one or more additional 

2 sessions. 

1 5. The method of claim Iftifflier comprising filtering the plurality of packets received 

2 over the network intej:^e prior to the analyzing, the filtering comprising removing one or 

3 more packets ^^fi'mn the plurality of packets according to one or more packet capture language 

4 rules. 
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1 6. The method of claim 1 further comprising outputting a plurality of service detail 

2 records at predetermined intervals for the application, each service detail record including a 

3 billing identifier and a usage information, the usage information derived fi-om the number of 

4 packets in the session during the corresponding predetermined interval. 

1 7. The method of claim 1 fiirther comprising sending a command to a network device to 

2 control the session based on a policy, the policy defining a quality of service for the 

3 application. 

1 8. The method of claim 1 further comprising sending a command to a network device to 

2 control the session based on a policy, the policy defining the amoxmt of resources available to 

3 the session. 

1 9. The method of claim 1 further comprising sending a command to a network device to 

2 stop the session based on a policy, the policy specifying a cost for use of resources and the 

3 policy triggering the transmission of the command upon the cost exceeding a predetermined 

4 amount. 



nO. A system for reconstructing a sessioiyflle system comprising: 

2 ' a packet source, the packet soprde generating a plurality of packets; 

3 a flow manager couple^i^ the packet source, the flow manager identifying at least one 

4 flow in the pl^lity of packets; 

5 an applicajion recognizer coupled to the flow manager, the application recognizer 

6 idratifying an application corresponding to the at least one flow; 
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7 a session streamer coupledjd^e flow manager, the session streamer identifying a 

8 plurality of flows^ the plurality of packets corresponding to the session based on 

9 the applicanon. 

1 11. The system opclaim 10, wherein each of the plurality of packets includes a plurality of 

2 header elements and the atJeast one flow includes one or more packets with a common packet 

3 header element: \ 

1 12. The system of claim 10, wherein the application recognizer can identify at least one of 

2 a file transfer protocol (FTP), a hypertext transfer protocol (HTTP), a simple mail transport 

3 protocol (SMTP), a domain name service (DNS), a telnet protocol, a post office protocol 

4 (POP), an Intemet message access protocol (IMAP), a network time protocol (NTP), a 

5 Netbios protocol, a network news transport protocol (NNTP), a network time protocol (NTP), 

6 a simple network management protocol (SNMP), an Intemet Relay Chat (IRC) protocol, a 

7 H.323 protocol, a voice over IP protocol, a NetMeeting(TM) protocol, a Quicktime(TM) 

8 protocol, a server message block (SMB) protocol, a RealAudio(TM) protocol, a real time 

9 streaming protocol (RTSP), and a real-time transport protocol (RTP). 

IT. The system of claim^iO, wherein the application recognizer signals to the session 

2 streamer to treat the^tleast one flow as a session when the appHcation recognizer cannot 

3 identify an application for the at least one flow: 

1 14. The system of claim 10, further comprising a data collector coupled to the session 

2 streamer, the data collector for producing service detail records at predetermined intervals for 
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# # 

3 the application corresponding to the session, each service detail record including a billing 

4 identifier and a usage information. 

5. An apparatus for reconstructing a session, the^^i^aratus comprising: 

2 means for receiving a plurality of pack^ 

3 means for identifying at least^^fi^t flow in the plurality of packets; 

4 means for identifyine^ifapplication for the at least a first flow; 

5 means for selecting a corresponding application flow identifier for the application; 

6 means foHdentifying a plurality of flows in the plurality of packets corresponding to 

7 ytne session using the corresponding application flow identifier. 

1 16. The apparatus of claim 15, further comprising means for reporting application 

2 appropriate performance characteristics for the session. 

1 17. The apparatus of claim 15, further comprising means for controlling a network device 

2 according to a policy, the policy defining the amount of resources available to the session. 

1 18. The apparatus of claim 1 5^^ftmher comprising means for charging at least one account 

2 for resources used during thQ<|pssion. 

1 19. A computer data signal embodied in apamer wave comprising: 

a computer program for session/i^onstruction: 

3 a first set of instructipiis for identifying at least one flow in a plurality of packets; 

4 a second set ofinstructions for analyzing the at least one flow to identify an 

5 applic^on corresponding to the flow; and 
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6 
7 



a third set of instructions fop^dentifying a plurality of flows in the plurality of 
packets corresnofiding to the session based on the application. 
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